topic Re: Oauth2 and single redirect url in APIs & Integrations

Oauth2 and single redirect url

PPłonka — Wed, 26 Jan 2022 11:46:55 GMT

Hello,

Is there already a possibility to use many redirect urls for oauth2?

If not, is there any workaround for multi tenant app?

best regards

Re: Oauth2 and single redirect url

dennisedson — Thu, 27 Jan 2022 14:47:59 GMT

@PPłonka

Could you add some more details to the question?

@himanshurauthan might be able to assist 😉

Re: Oauth2 and single redirect url

PPłonka — Thu, 27 Jan 2022 16:29:59 GMT

@dennisedson sure, thanks for answer!

Oauth2 here allows only one redirect_url. But when i have multi tenant app i need many redirect urls because every tenant has different domain.

So the question is: Is it possible to handle many redirect_url's and if not - is there any work around to allow many tenants to authorize themselfs with my hubspot app.

Re: Oauth2 and single redirect url

himanshurauthan — Tue, 01 Feb 2022 07:22:36 GMT

Hello @PPłonka,

You can use different Redirect_url while connecting the store with the HubSpot portal. Also, you can leave Redirect_url empty in your app, and at the time of authentication, you can send different URLs.

Refer to the doc on how can you use redirect_urls while authentication.

Regards,

Re: Oauth2 and single redirect url

RRichard — Tue, 08 Feb 2022 20:15:16 GMT

Hi,

leaving a empty rediriect_urls causes security incidents. If you have not restricted the callback URL for the OAuth application, that will allow the attacker to redirect the auth code to the attacker-controlled URL.

We have active incident in bugcrowd and we don't know how to fix this 😕

Maybe some wildcards in redirect_url will be avialable in the future?

Regrads